CVE-2026-8451 — Citrix NetScaler SAML IDP Memory Overread ("new CitrixBleed")

What it is. CVE-2026-8451 is an unauthenticated out-of-bounds read (memory overread) in the XML parser of Citrix NetScaler ADC and NetScaler Gateway appliances that are configured as a SAML Identity Provider (IDP). The parser fails to terminate an unquoted XML attribute value that is followed by a newline, so it reads past the intended buffer and returns adjacent process memory to the attacker inside the NSC_TASS cookie of the HTTP response. No authentication and no user interaction are required. CVSS 8.8.

Why it matters. The leaked memory is drawn from the NetScaler process that handles authentication, so — exactly like the original CitrixBleed (CVE-2023-4966) and CitrixBleed 2 — it can disclose live session tokens, AAA cookies, and credential fragments. An attacker repeatedly polls the endpoint to reassemble valid sessions, then replays them to walk straight past MFA into whatever the gateway fronts (VPN, VDI, internal web apps). Citrix disclosed the flaw and shipped fixes on 30 June 2026; active exploitation was confirmed within 24 hours, with initial scanning from Frankfurt IP 146.70.139[.]154 followed by probes from Hong Kong infrastructure.

The hunt problem. The vulnerable appliance is not a Falcon-instrumented endpoint, so the exploit primitive itself is invisible to EDR. This pack therefore hunts on two honest planes: (1) native NetScaler telemetry — web/proxy/appliance logs for the malformed <samlp:AuthnRequest> probe and abnormal NSC_TASS responses; and (2) Falcon post-exploitation telemetry — session replay and lateral movement landing on the internal, instrumented estate behind the gateway (anomalous authenticated sessions, recon bursts, and C2 egress to attacker infrastructure).

Defender priority: Patch to a fixed build (14.1-72.61 / 13.1-63.18 or later) and terminate all active ICA/PCoIP/AAA/SAML sessions — a patch alone does not evict a session already stolen from memory before you patched. Then hunt the internal estate for replayed sessions, because CitrixBleed-class bugs are exploited for the session, not the shell.

Intel gaps / perishability: Only one attacker source IP (146.70.139[.]154) is publicly attributed so far; the Hong Kong IPs are unpublished. Atomic host IOCs (payload hashes, C2 domains) are not yet published because the value is stolen sessions, not dropped malware — expect the atomic set to stay thin. Treat the behavioral and native-log hunts as the primary detections and the IP as a supporting indicator.

Hunt hypotheses (fidelity-ordered)

Attack chain

No malware hashes or C2 domains are published for CVE-2026-8451 — the exploit yields a session, not a file. The IOC appendix (§10) ships placeholder-driven CSV blocks so you can wire your own confirmed indicators; the behavioral and config indicators above are the durable detections.

Coverage reality: the exploit itself is only visible in native appliance/web telemetry. If NetScaler logs are not forwarded to your SIEM, H1 (the highest-fidelity hypothesis) is blind — prioritize log forwarding as the fastest coverage win.

These run against the appliance itself and its fronting web tier — the only place the exploit primitive is visible. Forward NetScaler logs to your SIEM if you have not already.

On the NetScaler (CLI / shell)

• Confirm exposure: from the NS CLI, show samlidPProfile and show ns version — you are exposed if a SAML IDP profile is bound to a vserver and the build is below 14.1-72.61 / 13.1-63.18.
• Malformed SAML probe: in the shell, search the web/proxy log for requests to the /saml/login path whose body contains a bare <samlp:AuthnRequest> with a long run of trailing spaces before a newline. Cross-reference by source IP for high request rates.
• Oversized NSC_TASS: hunt access logs for responses on the SAML flow that set an NSC_TASS cookie with an unusually long value versus your baseline — the leaked memory is returned there.
• Session anomalies: review the AAA / ICA session table (show aaa session, show ica connections) for sessions with no matching interactive logon, geographically improbable source, or reuse across source IPs.

On the web/WAF tier in front of NetScaler

• Alert on POST/GET to /saml/login where the body length is dominated by whitespace or the <samlp:AuthnRequest> element is unclosed/attribute-malformed.
• Rate-limit and log per-source request counts to the SAML endpoint; a single source issuing thousands of SAML requests in minutes is the harvest loop.

On the identity provider (Entra ID / ADFS / Okta)

• Hunt sign-ins that use a session/token issued via the NetScaler SAML flow but originate from an IP/ASN that never appears for that user — the replay landing point. In Entra, pivot on SigninLogs by session ID + IP/ASN novelty.

The appliance is not Falcon-instrumented, so these queries hunt the internal estate behind the gateway. Replace the placeholder IP/subnet lists with your own NetScaler VIP/SNIP and DMZ ranges before running — they are marked REPLACE_* in-query.

// HUNT: Inbound connection from CVE-2026-8451 scanning IP
// MITRE: T1190 | CONF: medium  FP: low  COST: low | REQUIRES: NetworkConnectIP4
#event_simpleName=/NetworkConnectIP4|NetworkReceiveIP4/
| RemoteAddressIP4=/^146\.70\.139\.154$/
| table([ComputerName, aid, LocalAddressIP4, LocalPort, RemoteAddressIP4, RemotePort, ConnectionDirection], limit=200)

// HUNT: DMZ host beaconing to CVE-2026-8451 attacker IP
// MITRE: T1071 / T1041 | CONF: medium  FP: medium  COST: low | REQUIRES: NetworkConnectIP4
// TUNING: set LocalAddressIP4 regex to YOUR DMZ/appliance segment (e.g. 10.20.30.x)
#event_simpleName=/NetworkConnectIP4/
| ConnectionDirection=/^0$/
| RemoteAddressIP4=/^146\.70\.139\.154$/
| LocalAddressIP4=/^REPLACE_DMZ_SUBNET/
| table([ComputerName, aid, ContextBaseFileName, LocalAddressIP4, RemoteAddressIP4, RemotePort], limit=200)

// HUNT: Authenticated network logons originating from the NetScaler VIP/SNIP
// MITRE: T1550.004 / T1078 | CONF: medium  FP: medium  COST: medium | REQUIRES: UserLogon
// TUNING: set RemoteAddressIP4 regex to YOUR NetScaler VIP/SNIP addresses
#event_simpleName=/UserLogon/
| LogonType=/^(3|10)$/
| RemoteAddressIP4=/^REPLACE_NETSCALER_VIP/
| groupBy([UserName, ComputerName], function=count(as=logons))
| test(logons >= 1)
| sort(logons, order=desc)
| table([UserName, ComputerName, logons], limit=200)

// HUNT: Discovery utility burst on a single host
// MITRE: T1087 / T1016 / T1033 | CONF: medium  FP: medium  COST: medium | REQUIRES: ProcessRollup2
// TUNING: exclude known admin/jump hosts and logon-script parents
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(whoami|nltest|quser|hostname|systeminfo|net1?|ipconfig|arp|route|tasklist)(\.exe)?$/i
| groupBy([ComputerName, aid], function=count(field=FileName, as=distinct_tools, distinct=true))
| test(distinct_tools >= 4)
| sort(distinct_tools, order=desc)
| table([ComputerName, aid, distinct_tools], limit=200)

// HUNT: Logons into internal hosts sourced from the DMZ segment
// MITRE: T1021 | CONF: medium  FP: medium  COST: medium | REQUIRES: UserLogon
// TUNING: set RemoteAddressIP4 regex to YOUR DMZ subnet; exclude sanctioned bastions
#event_simpleName=/UserLogon/
| LogonType=/^(3|9|10)$/
| RemoteAddressIP4=/^REPLACE_DMZ_SUBNET/
| table([UserName, ComputerName, LogonType, RemoteAddressIP4], limit=200)

// HUNT: Suspicious service/scheduled-task creation post-pivot
// MITRE: T1543.003 / T1053.005 | CONF: medium  FP: medium  COST: low | REQUIRES: ServiceInstalled / ScheduledTaskRegistered
// TUNING: exclude signed installer paths and RMM/patch-deployment parents (e.g. ccmexec, msiexec)
#event_simpleName=/CreateService|ModifyServiceBinary|ScheduledTaskRegistered/
| CommandLine=/(cmd(\.exe)?|powershell(\.exe)?|rundll32|regsvr32|mshta|wscript|cscript)/i
| table([ComputerName, aid, UserName, ServiceName, TaskName, CommandLine], limit=200)

The exploit is off-sensor, so IOAs here target the post-exploitation behavior on instrumented hosts. Promote only after baselining.

The highest-fidelity detection (H1, the malformed SAML probe) belongs in your WAF/NGSIEM rules against NetScaler logs, not a Falcon IOA — the appliance never reports to the sensor.

Playbook A — Patch, evict sessions, rotate (NetScaler CLI)

# 1. Confirm current version and exposure
show ns version
show samlidPProfile

# 2. Upload + install the fixed build via the CLI or GUI, then reboot
#    (target: 14.1-72.61 or 13.1-63.18 or later)

# 3. AFTER the appliance is on the fixed build, evict every live session
kill icaconnection -all
kill aaa session -all
kill pcoipConnection -all

# 4. Rotate the SAML IDP signing certificate and rebind
#    (generate/import new cert, then:)
#    set samlidPProfile <profile> -samlIdPCertName <new_cert>

# 5. Rotate any service-account / LDAP bind creds the appliance holds

Playbook B — WAF virtual-patch for the SAML overread (pseudo-rule)

# Reject malformed SAML AuthnRequest on the SAML endpoint:
IF  request.path == "/saml/login"
AND request.body matches "<samlp:AuthnRequest[^>]*[ ]{100,}\n"
THEN block, log(source_ip, request_id)

# Rate-limit the harvest loop:
IF  request.path == "/saml/login"
AND count(source_ip) > 50 within 60s
THEN throttle + alert

Playbook C — Entra sign-in replay hunt (KQL starter)

SigninLogs
| where AppDisplayName has_any ("NetScaler","Citrix Gateway","VPN")
| summarize ips = make_set(IPAddress), asns = make_set(AutonomousSystemNumber) by UserPrincipalName, SessionId
| where array_length(ips) > 1
// one session token seen from multiple IPs/ASNs = candidate replay

Known gaps: the exploit primitive and the memory-theft (T1190/T1539) are off-sensor — they are only recoverable from NetScaler/WAF logs (§7). The Falcon queries here begin at session replay. Closing the primary gap = forwarding appliance logs to the SIEM and deploying the native H1 rules.

Validation: telemetry-ready and benign-baseline gates (§11) must pass before Q3/Q4/Q6 are promoted from Investigate to Detect.